Where your data is stored
The operator app at app.stemline.ai runs on Amazon Web Services in Ireland (eu-west-1). Your firm's database is PostgreSQL 16 on Amazon RDS in the same region. The marketing site at www.stemline.ai is hosted separately on Vercel.
How firms are kept separate
All firms share one database. Each row that belongs to a firm is tagged with a firm ID and protected by PostgreSQL row-level security, with additional checks in the application. Shared industry reference data includes ports, fuel grades, public benchmark indices, FX rates and vessel identity lookups (IMO to MMSI). Your contacts, deals, communications, suppliers and margins stay private to your firm.
Encryption
- Database storage is encrypted at rest with AWS KMS.
- Connections to the database require SSL.
- The cache layer is encrypted at rest and in transit.
- HTTPS is used for the app and marketing site.
- Mailbox tokens and stored AI keys are encrypted with Fernet.
- Customer documents are stored in AWS S3 in eu-west-1.
AI and your data
- Model providers: OpenRouter (primary), Anthropic (fallback for sensitive email content, with zero retention requested) and OpenAI (only when a firm supplies its own provider key).
- No. Stemline does not use your firm's desk data to train public AI models. When you use AI features, the text needed for that request is sent to the model provider. Supported routes request zero data retention where the provider allows it.
- Agents can read communications, contacts, deals, supplier coverage and margin settings only to produce suggestions or drafts inside your firm.
Access control
- Roles: broker, manager and admin.
- Sign-in is by email code, Google or Microsoft. Enterprise SAML is not available today.
- Managers and admins approve agent tool actions and can require approval before pipeline stage changes.
Backups and retention
- CRM records are archived (soft-deleted) rather than hard-deleted in normal use.
- Automated RDS snapshots run in AWS. Contact admin@stemline.ai for the current snapshot retention period.
- Agent run history is purged after 90 days. Pending approvals expire after 7 days.
Your data, your control
- You can import your book from Excel or CSV.
- For a full export of your firm's data or to close an account, email admin@stemline.ai.
Subprocessors
| Name | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, cache, file storage, secrets | Ireland (eu-west-1) |
| Vercel | Marketing website hosting | Global edge network |
| Stripe | Subscription billing | EU and USA |
| Resend | Transactional email | EU and USA |
| OpenRouter | LLM routing | USA |
| Anthropic | LLM inference | USA |
| Sign-in and optional Gmail sync | EU and USA | |
| Microsoft | Sign-in and optional Outlook sync | EU and USA |
| Sentry | Error monitoring | EU and USA |
| CARTO | Map tiles | EU and USA |
| AIS and vessel data providers | Vessel positions and registry lookups | Varies by provider |
| Market data sources | Public benchmark and FX reference | Varies by source |
Legal
A data processing agreement is available on request at admin@stemline.ai. See also our terms and privacy summary on the legal page. Legal.
Report a security issue
Email admin@stemline.ai with details. We will acknowledge receipt and follow up.
Common questions
Where is my firm's data stored?
The operator app at app.stemline.ai runs on Amazon Web Services in Ireland (eu-west-1). Your firm's database is PostgreSQL 16 on Amazon RDS in the same region. The marketing site at www.stemline.ai is hosted separately on Vercel.
How are firms kept separate?
All firms share one database. Each row that belongs to a firm is tagged with a firm ID and protected by PostgreSQL row-level security, with additional checks in the application. Shared industry reference data includes ports, fuel grades, public benchmark indices, FX rates and vessel identity lookups (IMO to MMSI). Your contacts, deals, communications, suppliers and margins stay private to your firm.
Is my firm's data used to train AI models?
No. Stemline does not use your firm's desk data to train public AI models. When you use AI features, the text needed for that request is sent to the model provider. Supported routes request zero data retention where the provider allows it.
How do I report a security issue?
Email admin@stemline.ai with details. We will acknowledge receipt and follow up.